A business processing personal data must always consider what the appropriate lawful basis is for the intended processing. Many business leaders hear “legitimate interest” and think it is a shortcut around consent. Getting this wrong exposes your organisation to enforcement action, fines, and reputational damage. Under GDPR (Article 6), both are lawful bases for processing personal data, but they work very differently.
Here is what business leaders need to know.
Consent vs Legitimate Interest: the core difference
Consent means the individual actively agrees: freely, specifically, in an informed manner and unambiguously (Article 4(11) GDPR).
Legitimate Interest means you have a genuine, real-world reason to process data, and that reason holds up when weighed against the individual’s rights. This requires a careful assessment by the controller. If your organisation decides why and how personal data should be processed, it is the data controller.
To determine whether any given processing may be based on legitimate interest, controllers must carefully assess and document, before carrying out the relevant processing operations and not after, whether the relevant conditions are met.
Three conditions that must all be met (Article 6(1)(f) GDPR)
To rely on legitimate interest as a legal basis, the following three conditions must all be satisfied.
1. The pursuit of a legitimate interest
The controller or a third party must have a legitimate interest in processing the data. There is no fixed list of what counts as a legitimate interest. The GDPR does not define the concept, so in principle a wide range of interests can qualify. The European Commission gives these typical examples:
- when the processing takes place within a client relationship
- when personal data is processed for direct marketing purposes (note: electronic and postal channels are treated differently)
- to prevent fraud or to ensure the network and information security of your IT systems
2. Processing must be necessary
Processing is only “necessary” if the same goal cannot reasonably be achieved by other means that would be less intrusive to individuals’ rights and freedoms. If a less privacy-invasive alternative exists, you cannot rely on legitimate interest.
3. The balancing test
The data subject’s rights and freedoms must not override your legitimate interest. This condition requires a balancing test, and the outcome will depend on the specific circumstances of each case. Ask yourself whether individuals would reasonably expect their data to be used in this way, and whether they could be surprised or harmed by it.
Document it: the Legitimate Interest Assessment (LIA)
Once you have worked through the three conditions above, you must record your analysis in a Legitimate Interest Assessment. Though the term “Legitimate Interest Assessment” does not appear in the GDPR itself, the European Data Protection Board (EDPB) makes clear that documenting your analysis is necessary to demonstrate compliance with the accountability principle (Article 5(2) GDPR). It must record your purpose, why processing is necessary, and why your interest outweighs the impact on individuals. It must be completed before processing begins, not after the fact, and reassessed whenever circumstances change.
The LIA is your evidence that you approached the decision responsibly and in line with the law and should not be treated as a mere formality.
Your key obligations when relying on Legitimate Interest
Choosing Legitimate Interest as your lawful basis comes with ongoing responsibilities.
- Inform individuals in your Privacy Notice that you are relying on Legitimate Interest, what that interest is, and how they can object.
- Stop processing if someone objects. For direct marketing, this right is absolute under Article 21(2) and 21(3) GDPR. Even if a previous consideration with the balancing test came to the conclusion that there is a legitimate interest, this is overridden once an individual objects to the processing of data for direct marketing.
- Erase data on request and when no longer needed. Legitimate Interest does not justify indefinite retention. Data must be deleted when it is no longer needed for the purpose it was collected.
The direct marketing rule: channel matters
The lawful basis you can rely on depends on the channel you use.
- Postal mail: Legitimate Interest may apply, provided you have a lawful data source and include a clear opt-out in every mailing.
- Email, SMS and automated calls: Consent is required. Generally legitimate Interest does not apply (subject to limited exceptions such as the ‘soft opt-in’ in existing customer relationships). The ePrivacy Directive (2002/58/EC) applies on top of GDPR and takes precedence for these channels.
A final word
Legitimate Interest (Article 6(1)(f) GDPR) is one of six equal legal bases for processing personal data. It should neither be treated as a last resort nor chosen on the assumption that it is easier to rely on than the others (EDPB Guidelines, 2024). Choosing it requires a careful, informed and documented assessment.
Used correctly, Legitimate Interest is a powerful and flexible lawful basis. Used carelessly, it is a liability.
This article is for informational purposes only and does not constitute legal advice. Please consult your Data Protection Officer or legal counsel before making decisions about your lawful basis for processing. For further discussion, send me a comment or a message, I am happy to assist.